diff --git a/module/common/model.php b/module/common/model.php
index 99b0caa0d7..032599c50a 100644
--- a/module/common/model.php
+++ b/module/common/model.php
@@ -3640,7 +3640,7 @@ EOF;
     /**
      * Check object priv.
      *
-     * @param  string   $objectType
+     * @param  string   $objectType program|project|product|execution
      * @param  int      $objectID
      * @access public
      * @return bool
@@ -3648,31 +3648,9 @@ EOF;
     public function checkPrivByObject($objectType, $objectID)
     {
         $objectType = strtolower($objectType);
-        $canVisit   = true;
-        switch($objectType)
-        {
-            case 'custom':
-                $doclib  = $this->loadModel('doc')->getLibById($objectID);
-                $account = (string)$this->app->user->account;
-                if(($doclib->acl == 'custom' or $doclib->acl == 'private') and strpos($doclib->users, $account) === false and $doclib->addedBy !== $account) $canVisit = false;
-                break;
-            case 'product':
-                $doclib   = $this->loadModel('doc')->getLibById($objectID);
-                $canVisit = $this->loadModel('product')->checkPriv($doclib->product);
-                break;
-            case 'project':
-                $doclib   = $this->loadModel('doc')->getLibById($objectID);
-                $canVisit = $this->loadModel('project')->checkPriv($doclib->project);
-                break;
-            case 'execution':
-                $doclib   = $this->loadModel('doc')->getLibById($objectID);
-                $canVisit = $this->loadModel('execution')->checkPriv($doclib->execution);
-                break;
-            default:
-                break;
-        }
+        if(in_array($objectType, array('program', 'project', 'product', 'execution'))) return $this->loadModel($objectType)->checkPriv($objectID);
 
-        return $canVisit;
+        return false;
     }
 
 }
diff --git a/module/doc/control.php b/module/doc/control.php
index 91e400d1fb..206d328315 100755
--- a/module/doc/control.php
+++ b/module/doc/control.php
@@ -377,7 +377,19 @@ class doc extends control
 
         if(!empty($_POST))
         {
-            if($this->loadModel('common')->checkPrivByObject($objectType, $libID) === false) return $this->send(array('result' => 'fail', 'message' => $this->lang->doc->accessDenied));
+            $doclib   = $this->loadModel('doc')->getLibById($objectID);
+            $canVisit = true;
+            if('custom' == $objectType)
+            {
+                $account = $this->app->user->account;
+                if(($doclib->acl == 'custom' or $doclib->acl == 'private') and strpos($doclib->users, $account) === false and $doclib->addedBy !== $account) $canVisit = false;
+            }
+            else
+            {
+                $canVisit = $this->loadModel('common')->checkPrivByObject($objectType, $doclib->$objectType);
+            }
+            if(!$canVisit) return $this->send(array('result' => 'fail', 'message' => $this->lang->doc->accessDenied));
+
             $libID    = $this->post->lib;
             $moduleID = $this->post->module;
             if(empty($libID) and strpos($this->post->module, '_') !== false) list($libID, $moduleID) = explode('_', $this->post->module);
diff --git a/module/execution/control.php b/module/execution/control.php
index b8d819878d..c4a3e2aa91 100644
--- a/module/execution/control.php
+++ b/module/execution/control.php
@@ -2528,6 +2528,8 @@ class execution extends control
         $type = $this->config->vision == 'lite' ? 'kanban' : 'stage,sprint,kanban';
         if(empty($execution) || strpos($type, $execution->type) === false) return print(js::error($this->lang->notFound) . js::locate('back'));
 
+        if(!$this->loadModel('common')->checkPrivByObject('execution', $executionID)) return print(js::error($this->lang->execution->accessDenied) . js::locate($this->createLink('execution', 'all')));
+
         $execution->projectInfo = $this->loadModel('project')->getByID($execution->project);
 
         $programList = array_filter(explode(',', $execution->projectInfo->path));
@@ -2730,6 +2732,7 @@ class execution extends control
      */
     public function taskKanban($executionID, $browseType = 'all', $orderBy = 'order_asc', $groupBy = '')
     {
+        if(!$this->loadModel('common')->checkPrivByObject('execution', $executionID)) return print(js::error($this->lang->execution->accessDenied) . js::locate($this->createLink('execution', 'all')));
         if(empty($groupBy)) $groupBy = 'default';
 
         /* Save to session. */
diff --git a/module/execution/model.php b/module/execution/model.php
index 6988651415..3e21ab49b5 100755
--- a/module/execution/model.php
+++ b/module/execution/model.php
@@ -23,11 +23,7 @@ class executionModel extends model
      */
     public function checkPriv($executionID)
     {
-        if(empty($executionID)) return false;
-
-        /* If is admin, return true. */
-        if($this->app->user->admin) return true;
-        return (strpos(",{$this->app->user->view->sprints},", ",{$executionID},") !== false);
+        return !empty($executionID) && ($this->app->user->admin || (strpos(",{$this->app->user->view->sprints},", ",{$executionID},") !== false));
     }
 
     /**
diff --git a/module/product/model.php b/module/product/model.php
index c4f17ac1d5..628fe27817 100755
--- a/module/product/model.php
+++ b/module/product/model.php
@@ -207,11 +207,7 @@ class productModel extends model
      */
     public function checkPriv($productID)
     {
-        if(empty($productID)) return false;
-
-        /* Is admin? */
-        if($this->app->user->admin) return true;
-        return (strpos(",{$this->app->user->view->products},", ",{$productID},") !== false);
+        return !empty($productID) && ($this->app->user->admin || (strpos(",{$this->app->user->view->products},", ",{$productID},") !== false));
     }
 
     /**
diff --git a/module/program/model.php b/module/program/model.php
index fb2a74b526..ecffecc569 100644
--- a/module/program/model.php
+++ b/module/program/model.php
@@ -1611,4 +1611,16 @@ class programModel extends model
 
         return $programID;
     }
+
+    /**
+     * Check the privilege.
+     *
+     * @param  int    $programID
+     * @access public
+     * @return bool
+     */
+    public function checkPriv($programID)
+    {
+        return !empty($programID) && ($this->app->user->admin || (strpos(",{$this->app->user->view->programs},", ",{$programID},") !== false));
+    }
 }
diff --git a/module/project/model.php b/module/project/model.php
index e68bfb925a..d3e054f3cb 100644
--- a/module/project/model.php
+++ b/module/project/model.php
@@ -10,11 +10,7 @@ class projectModel extends model
      */
     public function checkPriv($projectID)
     {
-        if(empty($projectID)) return false;
-
-        /* If is admin, return true. */
-        if($this->app->user->admin) return true;
-        return (strpos(",{$this->app->user->view->projects},", ",{$projectID},") !== false);
+        return !empty($projectID) && ($this->app->user->admin || (strpos(",{$this->app->user->view->projects},", ",{$projectID},") !== false));
     }
 
     /**
diff --git a/module/task/control.php b/module/task/control.php
index e0964e1409..2eabbb6f63 100755
--- a/module/task/control.php
+++ b/module/task/control.php
@@ -952,6 +952,7 @@ class task extends control
             if(defined('RUN_MODE') && RUN_MODE == 'api') return $this->send(array('status' => 'fail', 'code' => 404, 'message' => '404 Not found'));
             return print(js::error($this->lang->notFound) . js::locate($this->createLink('execution', 'all')));
         }
+        if(!$this->loadModel('common')->checkPrivByObject('execution', $task->execution)) return print(js::error($this->lang->execution->accessDenied) . js::locate($this->createLink('execution', 'all')));
 
         $this->session->set('executionList', $this->app->getURI(true), 'execution');